CVE-2026-63358

HIGH 7.3

FileGator privilege escalation

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.

CWE	CWE-732
Vendor	filegator
Product	filegator
Published	Jul 21, 2026

Stay Ahead of the Next One

Get instant alerts for filegator filegator

Be the first to know when new high vulnerabilities affecting filegator filegator are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Affected Versions

FileGator / FileGator

0 < 7.14.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/filegator/filegator/blob/master/CHANGELOG.md#7142---2026-05-18 github.com: https://github.com/filegator/filegator/commit/4a44ed9a43f84505703dce669c68fb55270c3f2c github.com: https://github.com/filegator/filegator/tree/master cve.org: https://www.cve.org/CVERecord?id=CVE-2026-63358 raw.githubusercontent.com: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-202-03.json

Credits

Abdul Moiz